CVE-2005-1148

calendar.pl in CalendarScript 3.21 allows remote attackers to obtain sensitive information via invalid (1) year or (2) month parameters, which leaks the full pathname and debug information.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2005-05-02

Last modified

2024-08-07

Affected products

• Calendarscript (Calendarscript)

References

• http://securitytracker.com/id?1013705
• http://www.snkenjoi.com/secadv/secadv3.txt
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20102